# From Workflow Automation to Capability Closure: A Formal Framework for Safe and Revenue-Aware Customer Service AI

arXiv: https://arxiv.org/abs/2603.15978 · HTML: https://mlsanity.com/paper/2603.15978/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 52 references that are in the map.
- First posted on arXiv 16 Mar 2026.

## Builds on (most cited first, 3 of 3)

- [Constitutional AI: Harmlessness from AI Feedback](https://mlsanity.com/paper/2212.08073/) (2022)
- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)

## Abstract (arXiv)

Customer service automation is undergoing a structural transformation. The dominant paradigm is shifting from scripted chatbots and single-agent responders toward networks of specialised AI agents that compose capabilities dynamically across billing, service provision, payments, and fulfilment. This shift introduces a safety gap that no current platform has closed: two agents individually verified as safe can, when combined, reach a forbidden goal through an emergent conjunctive dependency that neither possesses alone.